KnowBe4 MCP

Surface users who clicked the bait in two or more distinct phishing security tests within a window — the hardest-to-train humans. Counts distinct clicked PSTs per user across every synced test; no single KnowBe4 API call spans PSTs. Reads the local store. Run 'knowbe4-cli sync' first (it walks per-PST recipients into the store).

Use this command to rank users or groups by their phish-report-vs-click behavior — how often they report simulated phish (the Phish Alert Button) versus falling for them. Surfaces the people who never report. Ratios reported vs clicked recipient rows across every synced PST; no KnowBe4 endpoint returns report behavior across tests. Do NOT use this command to rank overall human risk with full training context; use 'risk-leaderboard' instead. Reads the local store. Run 'knowbe4-cli sync' first.

Rank users and groups by how much their risk score moved between the latest local snapshot and the snapshot nearest (latest - window). The API returns a raw series per entity; it never returns a ranked delta across all entities. Risk snapshots accumulate every time you run 'knowbe4-cli sync' — drift needs at least two snapshots over the window to compute a delta.

Rank the highest-risk users, each enriched with their phishing click history, report count, and number of open (not-passed) trainings. The API exposes the risk score alone; the why-behind-the-score requires fusing users, phishing recipients, and training enrollments from the local store. Run 'knowbe4-cli sync' first.

Full-text search across all synced data. Faster than paginating list endpoints. Requires sync first.

Run read-only SQL against local database. Use for ad-hoc analysis, aggregations, and joins across synced resources. Requires sync first.

Store purchases — training content/modules licensed to your account

Get a single store purchase by id. Required: id. Returns the StorePurchase.

List all training store purchases (licensed content/modules). Optional: page (default: 1), per-page (default: 100). Returns array of StorePurchase.

Sync data from the API into a local SQLite database. Supports resumable incremental sync (only fetches new data since last sync) and full resync. Once synced, use the 'search' command for instant full-text search. Exit codes & warnings: Resources the API denies access to (HTTP 403, or HTTP 400 with an access-policy body) are reported as warnings rather than failing the run. In --json mode each is emitted as a {"event":"sync_warning",...} line carrying status, reason, and message fields, and a final {"event":"sync_summary",...} aggregates the run. Exit 0 when at least one resource synced and no resource flagged in the spec as critical (x-critical: true) failed; non-critical failures emit {"event":"sync_warning","reason":"exit_policy_default_changed", ...} so callers can detect that a partial failure was tolerated. Pass --strict to exit non-zero on any per-resource failure. Exit is always non-zero when every selected resource failed, regardless of --strict. Resource scoping: --resources runs the named top-level resources, plus any parent-keyed dependent whose own name is listed OR whose parent table is listed. Naming a parent therefore cascades to its dependents (so "sync this parent and its children" works without listing every nested resource by hand). There is no flag today to suppress the cascade for a named parent. To run a dependent without re-syncing its parent, list only the dependent by name; the parent table must already be populated from a prior sync.

Tail streams live data changes by polling the API at configurable intervals. Events are emitted as NDJSON to stdout for piping to other tools. Gracefully shuts down on SIGTERM/SIGINT. Note: For APIs with WebSocket or SSE support, a future version will use native streaming instead of polling.

Training campaigns — assigned security-awareness training programs

Training enrollments — per-user module assignments with completion status

Get a single training campaign by id. Required: id. Returns the TrainingCampaign.

List all training campaigns. Optional: page (default: 1), per-page (default: 100). Returns array of TrainingCampaign.

Get a single training enrollment by id. Required: id. Returns the TrainingEnrollment.

List all training enrollments with completion status and time spent. Optional: page (default: 1), per-page (default: 100), campaign-id (plus 1 more). Returns array of TrainingEnrollment.

Anti-join: users who clicked a phishing test but have no Passed/Completed training enrollment. Phishing results and training records are separate KnowBe4 endpoints the console never correlates — this is the most actionable remediation list a vCISO owns. Reads the local store. Run 'knowbe4-cli sync' first.

Users in the KnowBe4 console — phish-prone percentage, current risk score, group membership

Get a single user by id. Required: id. Returns the User.

List all users with risk score and phish-prone percentage. Optional: page (default: 1), per-page (default: 100), status (plus 1 more). Returns array of User.

Get a user's risk-score history time series. Required: id. Optional: full. Returns array of RiskScorePoint.

Compound workflows that combine multiple API operations

Archive fetches all syncable resources from the API and stores them in a local SQLite database. Supports incremental sync (only new data since last run) and full resync. After archiving, use 'search' for instant full-text search.

Show local archive status and sync state for all resources